I85PREP
⌘ K
ISACA AAIR study materials
ISACA AAIR study resources

ISACA AAIR practice questions

One question at a time. Build your ISACA AAIR understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1AI Enterprise Governance

An organization is establishing an AI governance function. Which body is primarily accountable for setting risk appetite for AI systems and overseeing that it is respected across business units?

  1. The IT service desk that handles user incidents
  2. The board of directors or a board-level committee Correct answer.
  3. The data science team that builds the models
  4. The external audit firm engaged for the annual opinion

Explanation

Governance accountability for risk appetite sits at the top of the organization, typically with the board or a delegated board committee such as an audit or technology risk committee. Operational teams execute within that appetite but cannot define or accept enterprise-level AI risk on their own.

Question 2AI Enterprise Governance

Which characteristic most distinguishes AI governance from traditional IT governance?

  1. It focuses exclusively on vendor contract management
  2. It relies on periodic project gate reviews at defined milestones
  3. It applies only to systems that process personal data
  4. It must address emergent, probabilistic system behavior and model change that occurs without code deployment Correct answer.

Explanation

AI systems can change behavior through retraining, data drift, or prompt and configuration changes, so governance must handle continuous, probabilistic change rather than only fixed release cycles. Traditional IT governance assumes more deterministic, versioned systems.

Question 3AI Enterprise Governance

Under the NIST AI Risk Management Framework, which function is concerned with prioritizing and acting on identified AI risks?

  1. Manage Correct answer.
  2. Govern
  3. Map
  4. Measure

Explanation

The NIST AI RMF defines four functions: Govern, Map, Measure, and Manage. Manage is the function where risks identified and measured are prioritized, treated, and monitored, with responses allocated and tracked over time.

Question 4AI Enterprise Governance

An AI governance committee wants an inventory of all AI systems in use, including shadow deployments by business units. Which practice best supports building that inventory?

  1. Requiring AI registration in a central inventory as part of the change and procurement workflow Correct answer.
  2. Asking the cloud provider to list workloads tied to the organization's billing account
  3. Relying on annual self-attestation from department heads alone
  4. Mandating procurement review only for purchases above a fixed cost threshold

Explanation

Embedding registration into existing change and procurement workflows captures systems at the point of introduction, including low-cost tools that evade thresholds. Self-attestation and provider billing views are incomplete because they miss locally built or free tools.

Question 5AI Enterprise Governance

What is the primary purpose of a three-lines model in AI governance?

  1. To require three approvals before any model is retired
  2. To divide the AI budget across three fiscal periods
  3. To assign three vendors to every AI system for redundancy
  4. To separate model development, independent risk oversight, and internal audit assurance Correct answer.

Explanation

The three-lines model separates management owning and operating controls, an independent risk or compliance function providing oversight, and internal audit providing independent assurance. This separation prevents the same group from both operating and assuring the same control.

Question 6AI Enterprise Governance

A regulator asks an organization to demonstrate that its AI systems are developed consistently with a recognized framework. Which artifact most directly provides that evidence?

  1. The source code repository commit history
  2. A mapping of internal AI policies and controls to the chosen framework's requirements Correct answer.
  3. The organization's general code of conduct
  4. The marketing brochure describing the AI product

Explanation

A framework mapping shows how internal policies and controls satisfy each requirement of the adopted standard, giving auditors and regulators traceable evidence. Generic documents and raw code do not demonstrate alignment to a specific framework.

Question 7AI Enterprise Governance

Which element is essential for an AI risk appetite statement to be usable by delivery teams?

  1. Qualitative statements of ambition without thresholds
  2. Quantitative tolerances tied to defined risk categories and escalation triggers Correct answer.
  3. A list of prohibited vendors
  4. A commitment to eliminate all AI risk

Explanation

Risk appetite becomes actionable when expressed as tolerances for specific risk categories, with defined thresholds that trigger escalation. Purely aspirational language gives teams no basis for decisions.

Question 8AI Enterprise Governance

An organization adopts the OECD AI Principles. Which principle addresses the need for accountability mechanisms for AI systems?

  1. Inclusive growth and sustainable development
  2. Transparency and explainability
  3. Human-centered values and fairness
  4. Accountability Correct answer.

Explanation

The OECD AI Principles include accountability, which requires that organizations be answerable for the proper functioning of AI systems and for remedying adverse outcomes. Transparency and fairness are separate principles in the same set.

Question 9AI Enterprise Governance

A bank wants its governance board to approve an AI system that makes credit decisions. Which information is most important for that approval decision?

  1. The number of developers assigned to the project
  2. The choice of programming language used
  3. The model's accuracy on the training set only
  4. The residual risks, mitigation status, and ongoing monitoring plan for the deployed system Correct answer.

Explanation

Approvers need a view of residual risk after controls, the status of mitigations, and how the system will be monitored in production. Training accuracy alone does not reflect deployment risk or ongoing control effectiveness.

Question 10AI Enterprise Governance

Which control best mitigates the risk of unauthorized changes to a production AI model?

  1. Increasing the size of the training dataset
  2. Scheduling monthly retraining regardless of change
  3. Enforcing version control, segregation of duties, and approval gates for model promotion Correct answer.
  4. Publishing the model architecture in a public repository

Explanation

Change control for models requires versioning, separation between those who build and those who approve promotion, and documented approval gates. These controls make unauthorized or unrecorded changes detectable and prevent single-person override.

Question 11AI Enterprise Governance

What is the main governance purpose of documenting an AI system's intended use and known limitations?

  1. To satisfy a one-time filing requirement only
  2. To set the boundary within which deployment is authorized and to inform downstream users Correct answer.
  3. To reduce the licensing cost of the model
  4. To prevent any future updates to the system

Explanation

Intended use and limitations define the authorized operating envelope and give downstream users the information needed to use the system safely. This documentation also supports accountability when a system is applied outside that envelope.

Question 12AI Enterprise Governance

A business unit wants to use a generative AI assistant for drafting client communications. Which governance action should occur first?

  1. Negotiate the vendor discount
  2. Announce the tool to clients
  3. Deploy the tool to a pilot group and evaluate risk afterward
  4. Complete an AI risk assessment covering data handling, output accuracy, and regulatory obligations Correct answer.

Explanation

Risk assessment before deployment identifies data protection, accuracy, and regulatory issues that determine whether and how the tool may be used. Deploying first and assessing later inverts the governance sequence and exposes the organization to unmanaged risk.

Question 13AI Enterprise Governance

Which metric best indicates whether an AI governance program is operating effectively rather than merely existing on paper?

  1. The total spend on AI tools
  2. The number of pages in the AI policy document
  3. The number of employees who have heard of the AI policy
  4. The percentage of AI systems that completed required reviews before deployment and the closure rate of identified issues Correct answer.

Explanation

Effectiveness is shown by coverage of required reviews and timely remediation of findings, which demonstrate that controls operate in practice. Volume-based or awareness-based measures show existence, not operating effectiveness.

Question 14AI Enterprise Governance

An organization operates in a jurisdiction with a comprehensive AI law that classifies systems by risk tier. What governance response is most appropriate?

  1. Map each AI system to its regulatory risk tier and apply the corresponding obligations Correct answer.
  2. Apply the highest-tier obligations to all AI systems regardless of use
  3. Ignore the law until enforcement actions occur
  4. Apply the law only to systems built by external vendors

Explanation

Risk-tiered regulation imposes obligations proportionate to the classification of each system, so governance must classify systems and apply the matching requirements. Blanket highest-tier treatment is inefficient, while selective or delayed application creates compliance exposure.

Question 15AI Enterprise Governance

Which role is best positioned to provide independent challenge to an AI model owner's risk assessment?

  1. A second-line risk function that does not report to the model owner Correct answer.
  2. A customer who uses the model's output
  3. A member of the model development team
  4. The vendor that supplied the model

Explanation

Independent challenge requires separation from the team that owns the model, which is the defining feature of the second line. Development staff, vendors, and customers have interests or perspectives that compromise objective challenge.

Question 16AI Enterprise Governance

An AI system's performance degrades gradually after deployment as customer behavior shifts. Which governance mechanism is designed to detect this?

  1. Annual review of the vendor contract
  2. A one-time validation performed before go-live
  3. Ongoing monitoring with defined drift thresholds and review triggers Correct answer.
  4. Periodic review of the AI policy document

Explanation

Post-deployment monitoring with explicit thresholds detects performance and data drift and triggers review before harm accumulates. Pre-deployment validation is a point-in-time control and cannot detect later degradation.

Question 17AI Enterprise Governance

Which practice best supports accountability when multiple vendors and internal teams contribute components to one AI system?

  1. Relying on the largest vendor to govern the whole system
  2. Assigning a single accountable owner for the integrated system with defined responsibilities across contributors Correct answer.
  3. Letting each contributor govern only its own component independently
  4. Documenting responsibilities only after an incident occurs

Explanation

A named accountable owner for the integrated system prevents gaps that arise when each party governs only its own component. Responsibility allocation across contributors should be defined and documented in advance, not reconstructed after an incident.

Question 18AI Enterprise Governance

What is the governance rationale for requiring human review of high-impact AI decisions?

  1. It eliminates the need for model monitoring
  2. It guarantees the model is free of bias
  3. It provides a point of human judgment and recourse before consequential outcomes are finalized Correct answer.
  4. It removes the need to document the model's limitations

Explanation

Human review inserts judgment and an opportunity for recourse before consequential decisions take effect. It does not remove the need for monitoring, documentation, or bias testing, which remain necessary controls.

Question 19AI Enterprise Governance

A governance team is defining escalation criteria for AI incidents. Which approach produces the most reliable triage?

  1. Escalating every incident to the board regardless of severity
  2. Delegating all triage decisions to the model vendor
  3. Defining severity tiers by impact on individuals, legal exposure, and scale, with response timelines per tier Correct answer.
  4. Escalating only incidents that attract media attention

Explanation

Severity tiers based on impact, legal exposure, and scale allow proportionate and timely response while preserving escalation for serious events. Uniform escalation causes fatigue, and reactive or outsourced triage leaves serious incidents mishandled.

Question 20AI Enterprise Governance

Which statement best describes the relationship between AI governance and enterprise risk management?

  1. AI governance replaces enterprise risk management for technology risks
  2. AI risk is integrated into enterprise risk management as a distinct risk category with its own assessment and reporting Correct answer.
  3. AI governance operates as an independent program unrelated to enterprise risk management
  4. Enterprise risk management applies only to financial risks and excludes AI

Explanation

AI risk is best treated as a distinct category within the enterprise risk framework so that it is aggregated, reported, and prioritized alongside other risks. Treating it as a separate silo or a replacement fragments risk visibility at the top of the organization.

Question 21AI Enterprise Governance

What is the primary governance value of an AI system's model card or system card?

  1. It serves as the legal contract with the vendor
  2. It provides standardized disclosure of intended use, performance, and limitations to support informed decisions by users and reviewers Correct answer.
  3. It replaces the need for periodic revalidation
  4. It contains the model's training source code

Explanation

Model and system cards standardize disclosure of intended use, evaluated performance, and limitations so that reviewers and users can make informed decisions. They are documentation artifacts, not contracts, code repositories, or substitutes for revalidation.

Question 22AI Enterprise Governance

A regulator requires that affected individuals receive an explanation of automated decisions. Which governance control most directly supports this obligation?

  1. Adding more features to the model to improve accuracy
  2. Maintaining records of decision factors and providing a defined explanation process for affected individuals Correct answer.
  3. Restricting access to the model to the development team
  4. Increasing the frequency of model retraining

Explanation

Meeting an explanation obligation requires the organization to retain decision-relevant information and operate a process that delivers explanations to affected individuals. Access restriction, retraining, and added features do not by themselves satisfy the obligation.

Question 23AI Enterprise Governance

Which situation most clearly represents an AI governance failure rather than a technical model failure?

  1. A model's accuracy drops after a data pipeline change
  2. A model is deployed to a high-impact use case without the required approval because no owner was assigned to enforce the gate Correct answer.
  3. A model produces an unexpected output on an edge-case input
  4. A training job fails due to insufficient compute

Explanation

A governance failure occurs when the control environment fails, such as an approval gate not being enforced because ownership was undefined. Accuracy drops, edge-case outputs, and compute failures are technical events that governance controls should detect and manage.

Question 24AI Enterprise Governance

Which approach best ensures AI governance policies remain relevant as technology and regulation evolve?

  1. Delegating policy ownership to the procurement team
  2. Updating the policy only when an incident occurs
  3. Scheduling periodic review with defined triggers for regulatory or material technology change Correct answer.
  4. Freezing the policy at initial publication to ensure consistency

Explanation

Periodic review combined with event-driven triggers keeps policy current without waiting for incidents or losing consistency. Freezing the policy guarantees obsolescence, and assigning ownership to procurement misplaces accountability.

Question 25AI Enterprise Governance

Senior leadership asks why AI governance should report through a committee rather than directly to individual business unit heads. Which argument is strongest?

  1. A cross-functional committee enables consistent risk decisions across units and prevents conflicts of interest from being resolved in isolation Correct answer.
  2. Reporting to business units is prohibited by all frameworks
  3. Committees eliminate the need for individual accountability
  4. Committees reduce the number of meetings required

Explanation

A cross-functional committee provides consistent application of risk criteria and surfaces conflicts that individual units would resolve in their own favor. It does not remove individual accountability, which remains assigned to named owners.

Question 26AI Enterprise Governance

An enterprise is establishing an AI governance function for the first time. Which artifact should define the authority, decision rights, and reporting lines of that function?

  1. An incident postmortem template for AI outages
  2. An AI governance charter approved by the board or executive committee Correct answer.
  3. A model performance dashboard refreshed weekly
  4. A vendor questionnaire used during AI procurement

Explanation

A governance charter is the foundational document that assigns authority, decision rights, membership, and reporting lines, which is what makes a governance body operable rather than advisory only. Questionnaires, dashboards, and templates are operational tools that support governance but do not establish it.

Question 27AI Enterprise Governance

Which committee structure best supports enterprise-wide AI governance in a large, diversified organization?

  1. A federated structure with an enterprise AI governance council setting policy and business-unit councils applying it Correct answer.
  2. Assignment of AI oversight to each data science team lead without a coordinating body
  3. Delegation of all AI oversight to the internal audit function
  4. A single centralized AI ethics review board that approves every model in the enterprise

Explanation

Federated governance pairs a central council that sets policy, risk appetite, and standards with business-unit bodies that apply them to local context, which scales without creating an approval bottleneck. Centralized approval of every model and fully decentralized team ownership both fail at scale, and internal audit provides assurance rather than governance.

Question 28AI Enterprise Governance

Which set of responsibilities belongs to the first line of defense in a three-lines model for AI risk?

  1. Independently auditing AI controls and reporting results to the audit committee
  2. Owning and operating AI systems and applying the controls assigned to them Correct answer.
  3. Setting enterprise AI risk appetite and approving policy exemptions
  4. Providing independent risk oversight and challenging first-line assessments

Explanation

The first line owns and runs the process, so it builds and operates AI systems and applies the required controls. Risk and compliance functions form the second line, and internal audit forms the third line with independent assurance.

Question 29AI Enterprise Governance

An AI governance council is drafting its terms of reference. Which item is most important to specify so the council can act decisively?

  1. The number of models reviewed in the prior year
  2. The decision rights and thresholds above which council approval is mandatory Correct answer.
  3. The meeting cadence and preferred collaboration platform
  4. The academic credentials required of council members

Explanation

Decision rights and materiality thresholds determine which AI use cases require council approval and which can proceed under delegated authority, which is what enables timely and consistent decisions. Cadence, tooling, and credentials are administrative details that do not confer decision authority.

Question 30AI Enterprise Governance

Which practice best embeds AI governance into an organization's existing product development lifecycle?

  1. Conducting an annual enterprise-wide AI risk survey of business units
  2. Publishing an AI principles statement on the corporate website
  3. Adding AI-specific risk assessment and approval gates to existing stage gates Correct answer.
  4. Requiring a separate governance process for every AI initiative

Explanation

Embedding AI risk assessment and approval gates into the stage gates already used for product delivery makes governance part of normal work rather than a parallel bureaucracy. Standalone processes and periodic surveys create duplication and delay, and a principles statement alone does not change delivery behavior.

Question 31AI Enterprise Governance

Which accountability model is most appropriate when an AI system is built by an internal team but relies on a foundation model from an external provider?

  1. Accountability transfers to the end users who accept the system's outputs
  2. The provider is accountable because the model originates outside the organization
  3. Accountability is shared equally and therefore not assigned to any single owner
  4. The internal deploying organization retains accountability for the system's use and outcomes Correct answer.

Explanation

Outsourcing a component does not outsource accountability: the deploying organization remains responsible for whether and how the system is used and for the outcomes it produces. Provider contracts allocate specific obligations, but they do not transfer the deployer's accountability to the vendor or to end users.

Question 32AI Enterprise Governance

What is the primary purpose of an AI system inventory in enterprise governance?

  1. To satisfy software license reconciliation requirements
  2. To rank data scientists by the number of models they have deployed
  3. To replace the need for individual model risk assessments
  4. To provide a complete, maintained record of AI systems that supports risk tiering and oversight Correct answer.

Explanation

An inventory establishes visibility over where AI is used so systems can be classified by risk and subjected to proportionate oversight. It is a prerequisite for governance, not a substitute for per-system assessment, and it is not a personnel or licensing instrument.

Question 33AI Enterprise Governance

An organization wants to tier its AI systems by risk. Which factor is most relevant to assigning a higher tier?

  1. The potential for significant harm to individuals or to the organization's legal standing Correct answer.
  2. The programming language used to implement the model
  3. The cloud region in which the model is hosted
  4. The number of features in the model's input dataset

Explanation

Risk tiering is driven by the severity and likelihood of harm, including impact on individuals' rights and safety and on legal and regulatory exposure. Implementation language, feature counts, and hosting region are technical attributes that do not by themselves indicate the significance of harm.

Question 34AI Enterprise Governance

Which governance mechanism best addresses the risk that an AI system's training data contains illegally obtained personal information?

  1. A quarterly review of model accuracy against a holdout dataset
  2. A post-deployment user feedback channel for reporting inaccurate outputs
  3. A service-level agreement covering model inference latency
  4. A data provenance and lawful-basis review completed before model training begins Correct answer.

Explanation

Lawful basis and provenance must be established before data is used, so a pre-training review is the control that prevents unlawful processing. Post-deployment feedback, accuracy testing, and latency agreements all operate after the data decision and do not address the lawfulness of the data itself.

Question 35AI Enterprise Governance

A governance policy states that high-risk AI systems must be validated by a party independent of the development team before release. Which arrangement satisfies this requirement?

  1. The vendor that supplied the training data confirms the dataset is complete
  2. The product owner approves release based on delivery milestones being met
  3. A model risk function outside the project team reviews evidence and issues an opinion Correct answer.
  4. The lead developer signs off after completing a self-assessment checklist

Explanation

Independence requires that the validating party is organizationally separate from those who built the system and has the authority to issue an opinion on it. Self-assessment and product-owner approval are performed by the development side, and a data vendor has no role in validating the model.

Question 36AI Enterprise Governance

Which element is most essential in an AI acceptable use policy for employees?

  1. Definitions of permitted and prohibited uses, plus reporting obligations for suspected misuse Correct answer.
  2. A schedule of model retraining frequencies for production systems
  3. A list of approved programming languages for model development
  4. A summary of the organization's historical AI project outcomes

Explanation

An acceptable use policy governs employee behavior, so it must state clearly what uses are permitted, what is prohibited, and how suspected misuse is reported. Language lists, retraining schedules, and project histories are technical or informational content that does not direct user conduct.

Question 37AI Enterprise Governance

An employee pastes confidential client data into a public generative AI tool to summarize a contract. Which governance gap does this most directly expose?

  1. Absence of enforceable controls and guidance on sanctioned AI tool use Correct answer.
  2. Insufficient model accuracy benchmarking
  3. Incomplete documentation of model hyperparameters
  4. Inadequate disaster recovery testing for AI systems

Explanation

The event shows that employees can move sensitive data into unsanctioned tools, which points to missing acceptable use guidance and technical controls such as data loss prevention or an approved tool with contractual protections. Accuracy benchmarking, disaster recovery, and hyperparameter documentation concern model quality and operations, not user data handling.

Question 38AI Enterprise Governance

Which approach best ensures that AI governance policy keeps pace with a fast-moving regulatory landscape?

  1. Assigning a named owner to monitor regulatory and technical developments and trigger periodic policy review Correct answer.
  2. Relying on vendors to notify the organization of relevant legal changes
  3. Reviewing the policy only after a regulatory enforcement action occurs
  4. Freezing the policy for a fixed multi-year period to provide stability

Explanation

Assigning explicit ownership for horizon scanning, with defined review triggers, converts policy maintenance into a continuous and accountable activity. Frozen policies become stale, vendors have no duty to track the organization's obligations, and reactive review leaves the organization exposed before enforcement.

Question 39AI Enterprise Governance

A regulator asks who is responsible for an AI system that caused harm. Which governance artifact most directly answers this question?

  1. The training dataset's schema definition
  2. The model's architecture diagram
  3. The system's RACI or accountability matrix naming the accountable executive Correct answer.
  4. The inference infrastructure cost report

Explanation

A named accountable owner is the artifact that answers who is responsible, because it assigns decision authority and answerability for the system. Architecture, data schema, and cost reporting describe the system technically or financially but do not assign responsibility.

Question 40AI Enterprise Governance

Which board-level committee is typically best suited to oversee enterprise AI risk?

  1. The compensation committee, because AI affects workforce planning
  2. The nomination committee, because AI requires new technical skills
  3. The audit committee exclusively, because AI systems generate log data
  4. The risk committee, because AI risk must be integrated with enterprise risk oversight Correct answer.

Explanation

AI risk is a category of enterprise risk, so the risk committee is the natural owner of oversight and can integrate it with the organization's risk appetite and reporting. Compensation, nomination, and audit committees have mandates focused on remuneration, board composition, and financial reporting assurance respectively.

Question 41AI Enterprise Governance

What distinguishes an AI governance council from a purely technical model review board?

  1. The governance council includes legal, risk, compliance, and business representation and weighs non-technical impacts Correct answer.
  2. The governance council meets only when a model fails in production
  3. The governance council is composed exclusively of data scientists
  4. The governance council focuses only on model accuracy metrics

Explanation

Enterprise AI governance is cross-disciplinary because it must weigh legal, ethical, operational, and business consequences alongside technical performance. A body limited to technical metrics or to data scientists cannot assess those broader impacts, and meeting only after failures is reactive rather than governing.

Question 42AI Enterprise Governance

An organization's AI governance program has policies and a council but no way to demonstrate that controls operate as intended. Which addition most improves the program's credibility with regulators?

  1. More frequent council meetings
  2. A revised AI principles statement
  3. A larger AI ethics training budget
  4. Independent testing of control effectiveness with documented results Correct answer.

Explanation

Assurance requires evidence that controls actually function, which comes from independent testing and documented results rather than from activity or intent. Meeting frequency, training spend, and principles statements demonstrate effort but not operating effectiveness.

Question 43AI Enterprise Governance

Which practice best manages AI risk arising from third-party model providers?

  1. Selecting the provider with the lowest per-token price
  2. Delegating all oversight to the provider's own ethics board
  3. Relying on the provider's public marketing materials for assurance
  4. Contractual rights to audit, incident notification, and model change disclosure, plus periodic review Correct answer.

Explanation

Third-party AI risk is managed through contractual levers that preserve visibility and recourse, such as audit rights, change notification, and incident reporting, combined with periodic review. Marketing claims are not assurance, price is not a risk control, and a provider's internal board cannot substitute for the deployer's own oversight.

Question 44AI Enterprise Governance

Which indicator best demonstrates that AI governance is embedded in operations rather than performed as a compliance ritual?

  1. The number of pages in the AI policy document
  2. The frequency of updates to the AI principles webpage
  3. The number of employees who attended an optional AI webinar
  4. The percentage of AI systems that passed required governance gates before deployment Correct answer.

Explanation

Embedding is evidenced when governance gates actually apply to systems before they go live, which is a measurable operational outcome. Document length, optional attendance, and webpage updates measure activity or presentation rather than whether governance changes deployment behavior.

Question 45AI Enterprise Governance

Which mechanism best ensures that AI risk decisions are escalated consistently across business units?

  1. Relying on individual employees to judge when escalation is warranted
  2. Escalating only when a customer files a formal complaint
  3. A centrally defined escalation matrix with defined triggers, roles, and timeframes Correct answer.
  4. Allowing each business unit to define its own escalation thresholds independently

Explanation

Consistency requires a common escalation standard specifying what triggers escalation, who must be informed, and within what timeframe, applied uniformly across units. Unit-specific thresholds, complaint-driven escalation, and individual judgment all produce inconsistent treatment of comparable risks.

Question 46AI Enterprise Governance

An AI system used in hiring shows a materially lower selection rate for one demographic group. Which governance response is most appropriate at the enterprise level?

  1. Remove the demographic attribute from the dataset and close the issue
  2. Treat it as a governance matter requiring impact assessment, root-cause analysis, and documented remediation with executive oversight Correct answer.
  3. Treat it as a model tuning issue and adjust the threshold until rates converge
  4. Continue operating while commissioning a long-term research study

Explanation

A disparate outcome in a high-impact domain such as hiring is a governance matter because it engages legal, ethical, and reputational risk, requiring documented assessment, root-cause analysis, and accountable remediation. Threshold adjustment, attribute removal, and continued operation while studying all fail to provide accountable and defensible treatment of the harm.

Question 47AI Enterprise Governance

Which governance arrangement best respects the independence of an AI ethics review function?

  1. The ethics reviewers' findings are advisory and cannot delay a launch
  2. The ethics reviewers report to the business unit whose product they review
  3. The ethics reviewers are selected by the product owner for each review
  4. The ethics reviewers report to a level of management independent of the product team and have defined escalation rights Correct answer.

Explanation

Independence requires that reviewers are not beholden to the team they assess, so they must report outside that team and have a defined route to escalate concerns. Reporting to the reviewed unit, being selected by the product owner, and lacking any ability to affect launch decisions all undermine independent judgment.

Question 48AI Enterprise Governance

An organization wants to define which AI systems require board notification. Which criterion is most defensible?

  1. Every AI system regardless of impact, to ensure completeness
  2. Systems built using a particular open-source framework
  3. Systems exceeding defined materiality thresholds such as high-risk classification, significant financial exposure, or affected population size Correct answer.
  4. Only systems that have already caused a reportable incident

Explanation

Notification thresholds should be tied to materiality, so the board receives information proportionate to the significance of the risk and can focus attention where it matters. Reporting everything dilutes attention, reporting only after incidents is reactive, and technology choice is unrelated to impact.

Question 49AI Enterprise Governance

A multinational deploys one AI system across jurisdictions with differing AI regulations. Which governance approach is most sound?

  1. Apply the requirements of the least restrictive jurisdiction uniformly to reduce cost
  2. Apply local requirements only where a regulator has opened an inquiry
  3. Delegate jurisdiction-by-jurisdiction compliance to local marketing teams
  4. Establish a baseline meeting the most stringent applicable requirement, then document jurisdiction-specific deviations Correct answer.

Explanation

A highest-common-denominator baseline creates a single defensible standard while documented deviations preserve local compliance, which is both efficient and auditable. Applying the least restrictive rule leaves the organization non-compliant elsewhere, reacting only to inquiries is reactive, and marketing teams lack the competence and mandate for regulatory compliance.

Question 50AI Enterprise Governance

Which practice best ensures that AI governance decisions are defensible when reviewed years later?

  1. Summarizing outcomes only in annual performance reviews
  2. Retaining only the final approved policy documents
  3. Relying on the institutional memory of long-tenured staff
  4. Recording the decision, the evidence considered, the rationale, and the accountable approver Correct answer.

Explanation

Defensibility depends on contemporaneous records showing what was decided, on what evidence, for what reason, and by whom, which allows later reviewers to assess whether judgment was sound. Institutional memory fades, performance reviews are not decision records, and retaining only final policies discards the reasoning that justifies decisions.